Vulnerabilities: Weaknesses or flaws in hardware, software, configurations, or processes in a computer system, network, or application.
Attacks: Deliberate actions or activities carried out by threat actors with intent to exploit vulnerabilities.
Hardware Vulnerabilities
Security flaws or weaknesses inherent in a devices physical components or design that can be exploited to compromise the Confidentiality, Integrity, or Availability of a system and its data.
Firmware: Form of software stored on hardware device that provides low-level control for device’s specific hardware.
End-of-life hardware: Hardware or software products that have reached the end of their lifecycle.
Legacy hardware: Outdated computing software, hardware, or technology that have been superseded by newer and more efficient alternatives.
Unpatched System: Device, application, or software that has not been updated with latest security patches so that it remains vulnerable to known exploits and attacks.
Hardware misconfigurations: Occurs when devices settings, parameters, or options are not properly set up, causing vulnerabilities to exist, performance decrease, or unintended behavior of device or system.
Mitigating Hardware Vulnerabilities
Hardening: Tightening security of a system.
Patching: Regular updating of software, firmware, and applications with latest security patches.
Configuration Enforcement: Ensure all devices and systems adhere to a standard secure configuration.
Decommissioning: System should be retired and removed from the network.
Isolation: Limit potential damage that might occur from a potential security breach.
Segmentation: Used to divide the network into segments.
Bluetooth Vulnerabilities and Attacks
Wireless technology standard used for exchanging data between fixed and mobile devices over short distances without an Internet connection.
Vulnerabilities
Insecure Device Pairing: When Bluetooth devices establish a connection without proper authentication.
Device Spoofing: When an attacker impersonates a device to trick a user into connecting.
On-Path Attack: Exploits Bluetooth protocol vulnerabilities to intercept and alter communications between devices without either party being aware.
Attacks
Bluejacking: Send unsolicited messages to a device.
Bluesnarfing: Unauthorized access of device through Bluetooth (e.g., steal contacts, call logs, text messages).
Bluebugging: Like bluesnarfing but stronger (lets attacker use device to make calls, send texts, access internet).
Bluesmack: Denial of Service.
Blueborne: Spreads over the air to multiple devices.
Mitigations
Turning off Bluetooth.
Ensuring that devices are set to non-discoverable mode.
Regularly updating devices.
Only pairing with known and trusted devices.
Always using unique PINs or passkeys.
Always being cautious of unsolicited connection requests.
Use encryption when transferring data over Bluetooth.
Mobile Vulnerabilities and Attacks
Vulnerabilities
Sideloading: Practice of installing applications on a device form unofficial sources.
Jailbreaking and Rooting: Gives users escalated privileges to circumvent built-in security measures provided by the devices.
Mobile Device Management (MDM)
Conduct patching of devices by pushing necessary updates and ensure latest security patches.
Zero-Day Vulnerabilities
Zero-Day Vulnerability: Vulnerability that is discovered or exploited before vendor can issue a patch.[^zero-day-mitigations]
Very expensive to develop, often saved for high-value attacks.
Zero-Day Exploit: Unknown exploit in the wild that exposes a previously unknown vulnerability in software or hardware.
Operating System Vulnerabilities
Unpatched Systems: Operating Systems that have not been updated with latest security patches or fixes.
Misconfigurations: When systems settings are not properly configured and leave system vulnerable to exploitation.
Data Exfiltration: Unauthorized data transfers from within an organization to an external location.
Malicious Updates: When attacker has been able to craft a malicious update to a well-known and trusted program in order to compromise the systems of the program’s end users.
SQL and XML Injection
Code Injection: Insertion of additional information or code through a data input form from a client to an application.
SQL Injection
Type of code injection that injects a SQL query. Can be done by entering data, modifying cookies, changing POST data, or using HTTP headers.
XML Injection
Extensible Markup Language (XML): Used by web applications for authentication, authorization, and other types of data exchange.
SQL Injection: Type of code injection that injects malicious XML to exploit an XML-driven application or service.
XML Bomb (Billion Laughs Attack): Encoded entities that expand to exponential sizes, consuming RAM on host and potentially crashing it.
XML External Entity (XXE): Attack that embeds a request for a local resource
Example: Canonical XXE payload
<?xml version="1.0" encoding="ISO-8859-1"?>
<!DOCTYPE foo [
<!ELEMENT foo ANY >
<!ENTITY xxe SYSTEM "file:///etc/shadow" >]>
<foo>&xxe;</foo>
Cross-Site Scripting and Cross-Site Request Forgery
Cross-Site Scripting
Cross-Site Scripting (XSS): Injects a malicious script into a trusted site to compromise site’s visitors.
Non-Persistent XSS: XSS attack that only occurs when it is launched and happens once.
Persistent XSS: Allows attacker to insert code into the backend database used by that trusted website.
Document Object Model (DOM) XSS: Exploits client’s web browser using client-side scripts to modify content/layout of web page.
Cross-Site Request Forgery
Session Management: Enables web applications to uniquely identify a user across several different actions and requests.
Cookie: Text files used to store information about a user.
Session Hijacking
Spoofing attack where attacker disconnects a host and replaces it with their own machine by spoofing the original host IP.
Session Prediction: Attacker attempts to predict the session token to hijack the session.
Cross-Site Request Forgery (CSRF): Malicious script is used to exploit a session started on another site within the same web browser.
Buffer Overflow
When data exceeds allocated memory, potentially enabling unauthorized access or code execution.
“Smashing the Stack”: When attacker can execute malicious code by overwriting a return address.
Mitigation
Address Space Layout Randomization (ASLR): Security measure that randomizes memory addresses.
Race Conditions
Software vulnerability where outcome depends on the timing of events not matching the developer’s intended order.
Time-of-Check (TOC): Race condition where attacker can alter a system resource after an application checks its state but before the operation is performed.
Time-of-Use (TOU): Race condition when attacker can change state of a system resource between time it is checked and time it is used.
Time-of-Evaluation (TOE): Race condition that involves manipulations of data or resources during time window when a system is making a decision or evaluation.
Mitigations
Mutex: Mutually exclusive flag that gatekeeps section of code so that only one thread can be processed at time.
Deadlock: When two or more processes are unable to proceed because each it waiting for the other to release a resource.